Creates and returns a new Audit Log object whish will store its logfiles in a given directory.

NewDiscardAuditLog returns a no-op audit log instance.

NewDiskSessionLogger creates new disk based session logger.

AuthAttemptEvent is authentication attempt that either succeeded or failed based on event status.

event ID (used as cursor value for enumeration, not stored).

OS login.

EventNamespace is a namespace of the session event.

event time.

event type/kind.

teleport user.

ExecEvent is an exec command executed by script or user on the server side.

address on the host.

LogfileExt defines the ending of the daily event log file.

LoginMethod is the event field indicating how the login was performed.

LoginMethodGithub represents login with Github.

LoginMethodLocal represents login with username/password.

LoginMethodOIDC represents login with OIDC.

LoginMethodSAML represents login with SAML.

MaxChunkBytes defines the maximum size of a session stream chunk that can be requested via AuditLog.GetSessionChunk().

Port forwarding event.

client (user's) address.

ResizeEvent means that some user resized PTY on the client.

SCPEvent means data transfer that occurred on the server.

SessionByteOffset is the number of bytes written to session stream since the beginning.

SessionEndEvent indicates that a session has ended.

SessionEventTimestamp is an offset (in milliseconds) since the beginning of the session when the terminal IO event happened.

SessionJoinEvent indicates that someone joined a session.

SessionLeaveEvent indicates that someone left a session.

SessionLogPrefix defines the endof of session log files.

SessionLogsDir is a subdirectory inside the eventlog data dir where all session-specific logs and streams are stored, like in /var/lib/teleport/logs/sessions.

SessionPrintEvent event happens every time a write occurs to temirnal I/O during a session.

SessionPrintEventBytes says how many bytes have been written into the session during "print" event.

SessionEvent indicates that session has been initiated or updated by a joining party on the server.

SessionStreamPrefix defines the ending of session stream files, that's where interactive PTY I/O is saved.

SubsystemEvent is the result of the execution of a subsystem.

expressed as 'W:H'.

UserLoginEvent indicates that a user logged into web UI or via tsh.

AuditLog is a new combined facility to record Teleport events and sessions.

AuditLogConfig specifies configuration for AuditLog server.

DiscardAuditLog is do-nothing, discard-everything implementation of IAuditLog interface used for cases when audit is turned off.

DiskSessionLogger implements a disk based session logger.

DiskSessionLoggerConfig sets up parameters for disk session logger associated with the session ID.

MockAuditLog is audit log used for tests.

SessionChunk is a chunk to be posted in the context of the session.

SessionSlice is a slice of submitted chunks.

IAuditLog is the primary (and the only external-facing) interface for AuditLogger.

SessionLogger is an interface that all session loggers must implement.

EventFields instance is attached to every logged event.